← Back to Vulnerability Reports CVE Intelligence

CVE-2026-31431

Linux Kernel•HIGH · CVSS 7.8• In the wild In CISA KEV

What is CVE-2026-31431?

In the Linux kernel, the following vulnerability has been resolved: crypto: algif_aead - Revert to operating out-of-place This mostly reverts commit 72548b093ee3 except for the copying of the associated data. There is no benefit in operating in-place in algif_aead since the source and destination come from different mappings. Get rid of all the complexity added for in-place operation and just copy the AD directly.

CVSS7.8 NVD 3.1

SeverityHIGH

Exploitation In the wild In CISA KEV

EPSS3% · P89

Triage statusActive Exploit

ActionPatch immediately

CVSS vectorCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWECWE-669, CWE-1288

NVD published2026-04-22

NVD last modified2026-09-08

Timeline

2026-04-22Published to the U.S. National Vulnerability Database (NVD)
2026-05-01First covered in a defend.network daily briefing
2026-05-01Added to the CISA Known Exploited Vulnerabilities (KEV) catalog
2026-05-15CISA federal remediation deadline (BOD 22-01)
2026-09-08NVD record last updated

CISA Known Exploited Vulnerability

Linux Kernel Incorrect Resource Transfer Between Spheres Vulnerability

Added to KEV2026-05-01

Federal patch deadline2026-05-15

Known ransomware useUnknown

Affected product

Linux Kernel

NVD also lists CPE entries for: Siemens Simatic S7-1500 Cpu 1518-4 Pn\/Dp Mfp Firmware, Siemens Simatic S7-1500 Cpu 1518-4 Pn\/Dp Mfp, Siemens Simatic S7-1500 Cpu 1518f-4 Pn\/Dp Mfp Firmware, Siemens Simatic S7-1500 Cpu 1518f-4 Pn\/Dp Mfp, Siemens Siplus S7-1500 Cpu 1518-4 Pn\/Dp Mfp Firmware

Remediation Steps

Identify all Linux systems running vulnerable kernel versions across your infrastructure
Prioritize patching systems with local user access or multi-tenant configurations
Apply kernel security updates from distribution vendors (RHEL, Ubuntu, Debian, etc.)
Schedule reboot windows to activate patched kernels and verify successful application
Monitor for suspicious local privilege escalation attempts in system audit logs

References

Referenced in our briefings & reports

Vulnerability Priority Report – Week 1 of May 2026 (May 4 – 10)
Linux root vulnerability in KEV; cPanel mass-exploitation continues (2026-05-04)
PyTorch Lightning & SAP supply-chain; AI cuts attack time to 24h (2026-05-01)

Related vulnerabilities

CVE-2025-39964 – Linux Kernel (same product)
CVE-2026-53362 – Linux Kernel (same product)
CVE-2026-53266 – Linux Kernel (same product)
CVE-2025-39682 – Linux Kernel (same product)
CVE-2022-0995 – Linux Kernel (same product)
CVE-2022-0492 – Linux Kernel (same product)

Linux: 31 known exploited vulnerabilities (CISA KEV) →

Browse all tracked CVEs in the defend.network CVE database →

🤖 This CVE page is generated by defend.network from NVD, CISA KEV, EPSS, and our verified daily briefings. Severity and exploitation data come from official sources; always verify remediation steps against the official vendor advisory before acting in production.